A single black-hat attacker exploited Fetch.ai, NuNet, and SingularityNET over the weekend and realized about $2.25 million in profit, according to Protos, which cited a report from Bitquery.
Bitquery said the nominal value of the tokens minted in the attacks was several times higher at the time of the theft. Blockchain security auditor PeckShield, which flagged the third incident, put the attacker’s unrealized profits at nearly $17 million.
In a post on X, PeckShield said the same exploiter had targeted SingularityNET, leading to the unauthorized minting of 260 million AGIX and 53.838 million WMTx on Ethereum. At the time, PeckShield said the exploiter held about $16.77 million in crypto, including 198.3 million AGIX worth $14.42 million and 649 ETH worth about $1.67 million.
Two attacks landed almost at the same time
Protos said two of the three projects were hit almost simultaneously. All three are part of the Artificial Superintelligence Alliance ecosystem.
The attacker first drained 8.7 million FET from Fetch.ai’s bridge and minted 400 million NTX tokens tied to NuNet. Hours later, the SingularityNET bridge was exploited as well. That incident led to the minting of 900 million AGIX, along with 500 million WMTx from World Mobile Chain and 500 million CGV from Cogito.
Most realized gains came from selling FET
Bitquery said the attacker sold the stolen FET for 523 ETH, or about $1.2 million. That accounted for the bulk of the realized gains.
Sales across the other four tokens brought in another 183 ETH, about $420,000 in total. The half-billion CGV tokens returned only $30 because liquidity was extremely thin.
With large portions of supply made up of freshly minted counterfeit tokens, the prices of the affected minted assets collapsed, the report said. By contrast, the sale of genuine FET led to a 5% drop in its price.
Bitquery pointed to broader infrastructure penetration
Bitquery also highlighted a preliminary sweep of ETH and BNB from 16 wallets. Four of those wallets had previously been labeled by the firm as SingularityNET or NuNet staff wallets, which it said pointed to broad penetration across the infrastructure of the interconnected companies.
In addition, $289,575 in USDC was later drained from a payroll contract.
The report warned that the majority of the signing keys have not been changed.
